closes #18 - PrincipalForApplicationUser#toString() now returns the u…

…ser's name....

... so that httpServletRequest.getPrincipal().getName() returns the users name when queried via Shiro.

dom/src/main/java/org/isisaddons/module/security/shiro/PrincipalForApplicationUser.java

@@ -19,11 +19,14 @@
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
+
 import com.google.common.collect.Iterables;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
+
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.Permission;
+
 import org.isisaddons.module.security.dom.permission.ApplicationPermissionValueSet;
 import org.isisaddons.module.security.dom.role.ApplicationRole;
 import org.isisaddons.module.security.dom.user.AccountType;
@@ -42,6 +45,9 @@
  *     {@link IsisModuleSecurityRealm#doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) authorization} merely involves
  *     creating an adapter object for the appropriate Shiro API.
  * </p>
+ *
+ * TODO: this should probably implement java.security.Principal so that it doesn't get wrapped in a
+ * ShiroHttpServletRequest.ObjectPrincipal.  Such a change would need some testing to avoid regressions, though.
  */
 class PrincipalForApplicationUser implements AuthorizationInfo {
 
@@ -127,4 +133,16 @@ ApplicationPermissionValueSet getPermissionSet() {
     public AccountType getAccountType() {
         return accountType;
     }
+
+    /**
+     * When wrapped by ShiroHttpServletRequest.ObjectPrincipal, the principal's name is derived by calling toString().
+     *
+     *  TODO: this should probably implement java.security.Principal so that it doesn't get wrapped in a
+     *  ShiroHttpServletRequest.ObjectPrincipal.  Such a change would need some testing to avoid regressions, though.
+     *
+     */
+    @Override
+    public String toString() {
+        return getUsername();
+    }
 }